lkml.org 
[lkml]   [2020]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 065/267] crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req()
    Date
    From: Longpeng(Mike) <longpeng2@huawei.com>

    [ Upstream commit b02989f37fc5e865ceeee9070907e4493b3a21e2 ]

    The system will crash when the users insmod crypto/tcrypt.ko with mode=38
    ( testing "cts(cbc(aes))" ).

    Usually the next entry of one sg will be @sg@ + 1, but if this sg element
    is part of a chained scatterlist, it could jump to the start of a new
    scatterlist array. Fix it by sg_next() on calculation of src/dst
    scatterlist.

    Fixes: dbaf0624ffa5 ("crypto: add virtio-crypto driver")
    Reported-by: LABBE Corentin <clabbe@baylibre.com>
    Cc: Herbert Xu <herbert@gondor.apana.org.au>
    Cc: "Michael S. Tsirkin" <mst@redhat.com>
    Cc: Jason Wang <jasowang@redhat.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: virtualization@lists.linux-foundation.org
    Cc: linux-kernel@vger.kernel.org
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20200123101000.GB24255@Red
    Signed-off-by: Gonglei <arei.gonglei@huawei.com>
    Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
    Link: https://lore.kernel.org/r/20200602070501.2023-2-longpeng2@huawei.com
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/crypto/virtio/virtio_crypto_algs.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c
    index 9348060cc32f..e9a8485c4929 100644
    --- a/drivers/crypto/virtio/virtio_crypto_algs.c
    +++ b/drivers/crypto/virtio/virtio_crypto_algs.c
    @@ -367,13 +367,18 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
    int err;
    unsigned long flags;
    struct scatterlist outhdr, iv_sg, status_sg, **sgs;
    - int i;
    u64 dst_len;
    unsigned int num_out = 0, num_in = 0;
    int sg_total;
    uint8_t *iv;
    + struct scatterlist *sg;

    src_nents = sg_nents_for_len(req->src, req->nbytes);
    + if (src_nents < 0) {
    + pr_err("Invalid number of src SG.\n");
    + return src_nents;
    + }
    +
    dst_nents = sg_nents(req->dst);

    pr_debug("virtio_crypto: Number of sgs (src_nents: %d, dst_nents: %d)\n",
    @@ -459,12 +464,12 @@ __virtio_crypto_ablkcipher_do_req(struct virtio_crypto_sym_request *vc_sym_req,
    vc_sym_req->iv = iv;

    /* Source data */
    - for (i = 0; i < src_nents; i++)
    - sgs[num_out++] = &req->src[i];
    + for (sg = req->src; src_nents; sg = sg_next(sg), src_nents--)
    + sgs[num_out++] = sg;

    /* Destination data */
    - for (i = 0; i < dst_nents; i++)
    - sgs[num_out + num_in++] = &req->dst[i];
    + for (sg = req->dst; sg; sg = sg_next(sg))
    + sgs[num_out + num_in++] = sg;

    /* Status */
    sg_init_one(&status_sg, &vc_req->status, sizeof(vc_req->status));
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-06-19 18:29    [W:4.068 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site